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REMARKS 



This Application has been carefully reviewed in light of the Office Action. 
Applicants appreciate the Examiner's consideration of the Application. In order to advance 
prosecution of this Application, Applicants have responded to each notation by the Examiner. 
Applicants respectfully request reconsideration and favorable action in this case. 



Section 102 Rejections 

The Examiner rejects Claims 1-28 under 35 U.S.C. § 102(b) over U.S. Patent 
Application Publication No. 2004/0015583 filed by Barrett et al. ("Barrett"). Applicants 
respectfully traverse this rejection for the reasons discussed below. 

Applicants respectfully submit that Barrett fails to disclose, or even teach or suggest, 
the elements specifically recited in Applicants' claims. For example, Barrett fails to disclose, 
teach, or suggest the following elements recited in amended independent Claim 1 : 

the IDS module having an IDS CPU, the IDS module operable to: 

determine that the IDS CPU has reached a particular threshold 

indicating that the IDS module is low on a resource; 

identify a volume associated with the incoming packets in response to 

the determination; 

Barrett merely discloses a detecting program 411 that detects increased volume of 

traffic: 

The post-processor 409 could also include a detecting program 411 for 
detecting abnormal multicast activity. Many known systems attempt to detect 
malicious attacks on the network. Typically these systems utilise static 
thresholds and compare numbers of incoming data packets, or the rate at 
which data packets are received, with the static thresholds. However, a 
problem with this approach is that it is difficult to distinguish between an 
increased volume of traffic relating to an increase in genuine usage and an 
increased volume of traffic relating to a malicious attack (e.g. flooding the 
network with packets). With no means of differentiating between the two, 
genuine multicast data can be incorrectly discarded. 
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In an attempt to overcome these problems, the detecting program 411 
evaluates, during the post-processing step generally referred to as S 5.4, (a) 
number of groups per Source Address, (b) number of groups per RP and, (c) 
for each peer, number of SA messages transmitted therefrom, and calculates 
changes in average numbers (for each of a, b, c). If the rate of change of 
average numbers exceeds a predetermined threshold, it generates an alert 
message. 

{Barrett, paragraphs 0072-0073.) That is, the passage discloses detecting an increased volume 
of traffic but does not disclose a detecting program CPU reaching a threshold. 

Consequently, at a minimum, Barrett fails to disclose, teach, or suggest an IDS 
module operable to "determine that the IDS CPU has reached a particular threshold 
indicating that the IDS module is low on a resource" much less "identify a volume 
associated with the incoming packets in response to the determination" of amended 
independent Claim 1. For at least these reasons, independent Claim 1 and its dependent 
claims are allowable under 35 U.S.C. § 102. For analogous reasons, independent Claims 8, 
15, and 22 and their respective dependent claims are allowable under 35 U.S.C. § 102. 
Accordingly, Applicants respectfully request reconsideration and allowance of Claims 1-28. 
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CONCLUSION 

Applicants have made an earnest attempt to place this case in condition for allowance. 
For at least the foregoing reasons, Applicants respectfully request full allowance of all the 
pending Claims. 

If the Examiner believes a telephone conference would advance prosecution of this 
case in any way, the Examiner is invited to contact Keiko Ichiye, the Attorney for Applicants, 
at the Examiner's convenience at (214) 953-6494. 

Although Applicants believe no fees are due, the Commissioner is hereby authorized 
to charge any fees or credit any overpayments to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 

Respectfully submitted, 

BAKER BOTTS L.L.P. 
Attorneys for Applicants 

Keiko Ichiye 
Reg. No. 45,460 

KI/ls 

Correspondence Address : 

Baker Botts L.L.P. 

2001 Ross Avenue, Suite 600 

Dallas, Texas 75201-2980 

(214) 953-6494 

Date: ^-/g"-"<ffff 

Customer Number: 05073 
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